Decryption Digest

CVE Analysis & Threat Intelligence Briefings

In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.

Free daily briefing

Every article here lands in subscribers' inboxes the morning it drops.

Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.

Free. No spam. Unsubscribe anytime.

Category:

3 results tagged VMware

CVE-2024-37085 Explained: VMware ESXi Active Directory Authentication Bypass

CVE REFERENCEJune 25, 202411 min

CVE-2024-37085: VMware ESXi AD Auth Bypass, Ransomware

CVE-2024-37085 is an authentication bypass (CVSS 6.8) in VMware ESXi that allows a domain user who is a member of an Active Directory group named 'ESX Admins' to gain full administrative access to the ESXi hypervisor, regardless of whether that group was explicitly configured for ESXi access. Exploited by at least five ransomware groups (Black Basta, Akira, Medusa, RansomHub, and Scattered Spider) to target ESXi hosts directly, encrypting VM storage files and achieving mass disruption across virtualised environments.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2021-22005: VMware vCenter Unauthenticated File Upload RCE

CVE REFERENCESeptember 21, 202110 min

CVE-2021-22005 Explained: VMware vCenter Unauthenticated RCE

CVE-2021-22005 is a critical unauthenticated file upload vulnerability in VMware vCenter Server's CEIP analytics service. Disclosed September 2021, it allowed any attacker with network access to the vCenter HTTPS interface to upload an arbitrary file and achieve remote code execution as the vCenter service account, effectively granting control of every managed virtual machine. Mass exploitation began within 48 hours of disclosure.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2021-21985 Explained: VMware vCenter Server Remote Code Execution

CVE REFERENCEMay 25, 20219 min

CVE-2021-21985 VMware vCenter: Unauthenticated Root RCE

CVE-2021-21985 is a critical remote code execution vulnerability in VMware vCenter Server's vSphere Client web interface. An unauthenticated attacker with network access to vCenter's HTTPS port can send a specially crafted request to the Virtual SAN Health Check plugin, enabled by default, to achieve RCE with root or SYSTEM privileges on the vCenter server. Compromise of vCenter means control over every virtual machine in the managed infrastructure.